Modifying a Role (Console) - AWS Identity and Access Management

Modifying a Role (Console)

You can use the AWS Management Console to modify a role. To change the set of tags on a role, see Managing Tags on IAM Entities (Console).

Modifying a Role Trust Policy (Console)

To change who can assume a role, you must modify the role's trust policy. You cannot modify the trust policy for a service-linked role.

Note

If a user is listed as the principal in a role's trust policy but cannot assume the role, check the user's permissions boundary. If a permissions boundary is set for the user, then it must allow the sts:AssumeRole action.

To modify a role trust policy (console)

  1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

  2. In the navigation pane of the IAM console, choose Roles.

  3. In the list of roles in your account, choose the name of the role that you want to modify.

  4. Choose the Trust relationships tab, and then choose Edit trust relationship.

  5. Edit the trust policy as needed. To add additional principals that can assume the role, specify them in the Principal element. For example, the following policy snippet shows how to reference two AWS accounts in the Principal element:

    "Principal": { "AWS": [ "arn:aws:iam::111122223333:root", "arn:aws:iam::444455556666:root" ] },

    If you specify a principal in another account, adding an account to the trust policy of a role is only half of establishing the cross-account trust relationship. By default, no users in the trusted accounts can assume the role. The administrator for the newly trusted account must grant the users the permission to assume the role. To do that, the administrator must create or edit a policy that is attached to the user to allow the user access to the sts:AssumeRole action. For more information, see the following procedure or Granting a User Permissions to Switch Roles.

    The following policy snippet shows how to reference two AWSservices in the Principal element:

    "Principal": { "Service": [ "opsworks.amazonaws.com", "ec2.amazonaws.com" ] },
  6. When you are finished editing your trust policy, choose Update Trust Policy to save your changes.

    For more information about policy structure and syntax, see Policies and Permissions and the IAM JSON Policy Elements Reference.

To allow users in a trusted external account to use the role (console)

For more information and detail about this procedure, see Granting a User Permissions to Switch Roles.

  1. Sign in to the trusted external AWS account.

  2. Decide whether to attach the permissions to a user or to a group. In the navigation pane of the IAM console, choose Users or Groups accordingly.

  3. Choose the name of the user or group to which you want to grant access, and then choose the Permissions tab.

  4. Do one of the following:

    • To edit a customer managed policy, choose the name of the policy, choose Edit policy, and then choose the JSON tab. You cannot edit an AWS managed policy. AWS managed policies appear with the AWS icon ( ). For more information about the difference between AWS managed policies and customer managed policies, see Managed Policies and Inline Policies.

    • To edit an inline policy, choose the arrow next to the name of the policy and choose Edit policy.

  5. In the policy editor, add a new Statement element that specifies the following:

    { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::ACCOUNT-ID:role/ROLE-NAME" }

    Replace the ARN in the statement with the ARN of the role that the user can assume.

  6. Follow the prompts on screen to finish editing the policy.

Modifying a Role Permissions Policy (Console)

To change the permissions allowed by the role, modify the role's permissions policy (or policies). You cannot modify the permissions policy for a service-linked role in IAM. You might be able to modify the permissions policy within the service that depends on the role. To check whether a service supports this feature, see AWS Services That Work with IAM and look for the services that have Yes in the Service-linked roles column. Choose a Yes with a link to view the service-linked role documentation for that service.

To change the permissions allowed by a role (console)

  1. Open the IAM console at https://console.aws.amazon.com/iam/.

  2. In the navigation pane of the IAM console, choose Roles.

  3. Choose the name of the role that you want to modify, and then choose the Permissions tab.

  4. Do one of the following:

    • To edit an existing customer managed policy, choose the name of the policy and then choose Edit policy.

      Note

      You cannot edit an AWS managed policy. AWS managed policy appear with the AWS icon ( ). For more information about the difference between AWS managed policies and customer managed policies, see Managed Policies and Inline Policies.

    • To attach an existing managed policy to the role, choose Add permissions.

    • To edit an existing inline policy, choose the arrow next to the name of the policy and choose Edit Policy.

    • To embed a new inline policy, choose Add inline policy.

Modifying a Role Description (Console)

To change the description of the role, modify the description text.

To change the description of a role (console)

  1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

  2. In the navigation pane of the IAM console, choose Roles.

  3. Choose the name of the role to modify.

  4. Next to Role description and on the far right, choose Edit.

  5. Type a new description in the box and choose Save.

Modifying a Role Maximum Session Duration (Console)

To specify the maximum session duration setting for roles that are assumed using the AWS CLI or API, modify the maximum session duration setting's value. This setting can have a value from 1 hour to 12 hours. If you do not specify a value, the default maximum of 1 hour is applied. This setting does not limit sessions assumed by AWS services.

Note

Anyone who assumes the role from the AWS CLI or API can use the duration-seconds CLI parameter or the DurationSeconds API parameter to request a longer session. The MaxSessionDuration setting determines the maximum duration of the role session that can be requested using the DurationSeconds parameter. If users don't specify a value for the DurationSeconds parameter, their security credentials are valid for one hour.

To change the maximum session duration setting for roles that are assumed using the AWS CLI or API (console)

  1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

  2. In the navigation pane of the IAM console, choose Roles.

  3. Choose the name of the role to modify.

  4. Next to Maximum CLI/API session duration choose a value. Or choose Custom duration and type a value (in seconds).

  5. Choose Save.

    Your changes don't take effect until the next time someone assumes this role. To learn how to revoke existing sessions for this role, see Revoking IAM Role Temporary Security Credentials.

Modifying a Role Permissions Boundary (Console)

To change the maximum permissions allowed for a role, modify the role's permissions boundary.

To change the policy used to set the permissions boundary for a role

  1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

  2. In the navigation pane, choose Roles.

  3. Choose the name of the role whose permissions boundary you want to change.

  4. Choose the Permissions tab. If necessary, open the Permissions boundary section and then choose Change boundary.

  5. Select the policy that you want to use for the permissions boundary.

  6. Choose Change boundary.

    Your changes don't take effect until the next time someone assumes this role.